# GitHub Advisory malware sweep - 2026-10-06 (3 fresh advisories: pypi `zencleaner` Discord-webhook infostealer + Windows event-log wipe, npm `virgil-cli` runtime conversation/shell-output exfil to api.nm-streetwear.space, npm `dotenv-async` CWE-506 boilerplate takedown; plus 2026-10-05 backfill: 2 npm `@inpeek/odata*` dep-confusion probes at 99.99.99-102 sentinel versions, pypi `erc7730-hackathon@99.0.0` OpenSSF-flagged PROBABLY_PENTEST probe; 25-gem RubyGems Ethereum/crypto wgkit cluster from 2026-10-05 SPLIT OUT)

> GHSA 2026-10-06: 3 fresh malware advisories (`zencleaner` pypi, `virgil-cli` + `dotenv-async` npm) plus 3 same-week backfill (`@inpeek/odata*` npm dep-confusion probes, `erc7730-hackathon` pypi pentest probe) across 5 clusters. The 25-gem [RubyGems Ethereum/crypto wgkit cluster](https://dependencywatch.io/incident/rubygems-2026-10-05-eth-crypto-wgkit-cluster) from 2026-10-05 is SPLIT OUT.

- Published: 2026-10-06
- Severity: high
- Kind: Advisory sweep - A dated batch of GitHub Advisory Database malware entries collected together. A sweep mixes kinds - typosquats, dependency-confusion probes, boilerplate takedowns with no published analysis, and occasionally real payloads - and its severity reflects the worst confirmed item, not the batch as a whole.
- Ecosystems: npm, PyPI
- Scope: 6 packages, 18 compromised versions
- Tags: typosquat, dependency-confusion, credential-theft, infostealer, obfuscation, dns-exfiltration
- Also known as: 2026-10-06 GHSA sweep, zencleaner Discord-webhook forensic-sabotage infostealer, virgil-cli nm-streetwear conversation exfil, @inpeek/odata dep-confusion sentinel probe, erc7730-hackathon OpenSSF PROBABLY_PENTEST probe
- Detected by: GitHub Advisory Database, OpenSSF malicious-packages, OpenSSF Package Analysis, Amazon Inspector, kam193/bad-packages
- Incident ID: multi-2026-10-06-ghsa-malware-sweep

## Affected packages (6)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@inpeek/odata](https://dependencywatch.io/package/npm/@inpeek/odata) | npm | 99.99.99, 99.99.100, 99.99.101, 99.99.102 |
| [@inpeek/odata-angular](https://dependencywatch.io/package/npm/@inpeek/odata-angular) | npm | 99.99.99, 99.99.100, 99.99.101, 99.99.102 |
| [dotenv-async](https://dependencywatch.io/package/npm/dotenv-async) | npm | 1.0.0 |
| [erc7730-hackathon](https://dependencywatch.io/package/pypi/erc7730-hackathon) | PyPI | 99.0.0 |
| [virgil-cli](https://dependencywatch.io/package/npm/virgil-cli) | npm | 0.1.0, 0.1.1, 0.1.2, 0.1.3, 0.1.4 |
| [zencleaner](https://dependencywatch.io/package/pypi/zencleaner) | PyPI | 1.0.0, 1.0.3, 1.0.3.1 |

## What happened

Between roughly 2026-10-05 06:17 UTC (end of yesterday`s sweep window) and 2026-10-06 11:00 UTC, the GitHub Advisory Database (via OpenSSF `malicious-packages`, Amazon Inspector`s IN-MAL feed, and `kam193/bad-packages`) published 3 fresh malware advisories for 2026-10-06 and left 3 same-week 2026-10-05 advisories uncovered by yesterday`s sweep (which only enumerated npm GHSAs with full-source disclosures). The 25-gem RubyGems Ethereum/crypto `wgkit.tar.gz` cluster from 2026-10-05 - also missed yesterday - is **SPLIT OUT** as its own named incident at [`rubygems-2026-10-05-eth-crypto-wgkit-cluster`](https://dependencywatch.io/incident/rubygems-2026-10-05-eth-crypto-wgkit-cluster) because the cluster shares one operator-coherent payload family and warrants dedicated IOC detail.

The remaining 2026-10-06 + 2026-10-05-backfill set breaks into **5 clusters**:

## Cluster A - pypi `zencleaner` Discord-webhook infostealer + Windows event-log wipe

`zencleaner` versions `1.0.0`, `1.0.3`, `1.0.3.1` (GHSA-4493-p4qp-qw6p, published 2026-10-06). The package advertises itself as a Windows cleaner that "makes no network communication"; `webhook_logger.py` POSTs to a hardcoded Discord webhook the user`s license keys, Windows username, hostname and client IP on every run, and `1.0.3`/`1.0.3.1` additionally enrich with `ipify.org` and `ifconfig.me` public-IP lookups. `cleaner_system.py` runs `wevtutil cl` across every Windows event log (Security included) with the author`s own comment reading "so forensic scanners report 0 entries" - an explicit forensic-sabotage primitive. Payload runs at use-time, not install-time, so install-only sandbox scanners pass it clean.

Classify as `malicious-package`, severity `high` (confirmed runtime infostealer + forensic sabotage on any Windows host).

## Cluster B - npm `virgil-cli` runtime conversation/shell-output exfil to `api.nm-streetwear.space`

`virgil-cli` versions `<=0.1.4` (GHSA-6j8f-g5mj-4wcj, published 2026-10-06). The package is marketed as a "free and private" local CLI. In practice `dist/api.js` exports `reportLearning()` which POSTs the **entire conversation history, every executed shell command, and every file-tool output** - with a hardcoded bearer token and per-install device id - to `https://api.nm-streetwear.space/vx/learn`. No opt-out, no README disclosure, no runtime flag to disable. The brand name "virgil" and the "learn" path are chosen to look like benign telemetry; it is a wholesale extraction of whatever the CLI touched.

Any developer who ran `virgil-cli` while piping real credentials, API tokens, SSH keys, kubeconfigs, `.env` contents, or an interactive conversation with another AI assistant through it should rotate everything that could have reached the CLI`s stdin/stdout and treat the package as unsafe at every version.

Classify as `malicious-package`, severity `high` (confirmed runtime exfil of credential-grade material).

## Cluster C - npm `dotenv-async` dotenv typosquat (CWE-506 boilerplate)

`dotenv-async` all versions (GHSA-gp83-4g76-4qg5, published 2026-10-06). GHSA ships only the CWE-506 boilerplate ("Any computer that has this package installed or running should be considered fully compromised") with no payload hash, no network IOC, and no source code preserved. The name typosquats the real `dotenv` and the `dotenv-webpack`/`dotenv-cli` family.

Classify as `typosquat`, severity `medium` (CWE-506 takedown with no published analysis).

## Cluster D - 2 npm `@inpeek/odata*` dep-confusion probes (BACKFILL 2026-10-05)

| Package | Versions | GHSA |
|---|---|---|
| `@inpeek/odata` | 99.99.99, 99.99.100, 99.99.101, 99.99.102 | GHSA-cmm5-vwvx-cv5f |
| `@inpeek/odata-angular` | 99.99.99, 99.99.100, 99.99.101, 99.99.102 | GHSA-7p27-jmq6-46ph |

Classic dep-confusion fingerprint: public `@inpeek/*` scope spraying four sequential sentinel versions on top of what is almost certainly an internal `@inpeek` registry. CWE-506 boilerplate takedown - no published payload, no C2, no hash.

Classify as `dependency-confusion`, severity `medium` (sentinel-version dep-confusion probe without disclosed second-stage).

## Cluster E - pypi `erc7730-hackathon` PROBABLY_PENTEST probe (BACKFILL 2026-10-05)

`erc7730-hackathon` versions `>=99.0.0` (GHSA-vcg2-mffq-hjmg, published 2026-10-05, SHA-256 `9020d8cb4fe701c7e0981ae140af20039845d5d0e0a638c68f3ca3e29adeb221`). OpenSSF classifies the package under its `GENERIC-standard-pypi-install-pentest` campaign - a probe that overrides `setup.py install` to exfiltrate IP addresses and username on install, no destructive payload. `erc7730` is the Ethereum ERC-7730 metadata-standard working group, so the "hackathon" tag plus sentinel `99.0.0` version strongly suggests a hackathon-targeted dep-confusion test rather than criminal infrastructure.

Classify as `dependency-confusion`, severity `medium` (PROBABLY_PENTEST labelled by OpenSSF, no second-stage disclosed).

## RubyGems - split-out operator-coherent cluster from 2026-10-05

[`rubygems-2026-10-05-eth-crypto-wgkit-cluster`](https://dependencywatch.io/incident/rubygems-2026-10-05-eth-crypto-wgkit-cluster) - 25 RubyGems packages, all v`1.0.0`, all delivering the `wgkit.tar.gz` dropper from the `45.138.0.0/16` superblock. Operator-coherent typosquat / brand-lure wave in the Ethereum, Bitcoin, Lightning, Web3 and TRON verticals. See that incident for the full IOC detail and 25-gem inventory. Was missed by yesterday`s 2026-10-05 sweep.

## Registry state

All 5 packages in this sweep window are registry-quarantined at time of writing. Active operator-side infrastructure named in today`s batch:

- Discord webhook channel (specific URL redacted in GHSA body) - Cluster A
- `ipify.org`, `ifconfig.me` IP-enrichment - Cluster A
- `api.nm-streetwear.space/vx/learn` - Cluster B
- `nm-streetwear.space` apex - Cluster B
- OpenSSF`s `GENERIC-standard-pypi-install-pentest` campaign tag - Cluster E (identifies this as the n-th probe in a long-running pentest-pipeline family)
- Source SHA-256 for `erc7730-hackathon`: `9020d8cb4fe701c7e0981ae140af20039845d5d0e0a638c68f3ca3e29adeb221`

## Discovery credits

`GitHub Advisory Database`, `OpenSSF malicious-packages`, `OpenSSF Package Analysis`, `Amazon Inspector`, `kam193/bad-packages`. Per-package IOC details drawn from GHSA advisory bodies published between 2026-10-05 06:17 UTC and 2026-10-06 11:00 UTC.

## Impact

- **Cluster A - pypi `zencleaner` Discord-webhook infostealer + Windows event-log wipe (malicious-package, confirmed runtime data exfil and forensic sabotage)**: `zencleaner` versions `1.0.0`, `1.0.3`, `1.0.3.1` (GHSA-4493-p4qp-qw6p). The package advertises itself as a Windows cleaner, promises no network communication in its README, and does the exact opposite. `webhook_logger.py` POSTs to a hard-coded Discord webhook the user`s license keys, computer name, Windows username and client IP on every run; `1.0.3` and `1.0.3.1` additionally fetch the public IP via `ipify.org` and `ifconfig.me`. `cleaner_system.py` runs `wevtutil cl` to clear every Windows event log, Security included, with a comment reading "so forensic scanners report 0 entries" - i.e. an explicit forensic-sabotage primitive, not a side effect. The payload runs at use-time, not install-time, so install-only sandbox scanners miss it. Classified `malicious-package`, severity `high` (confirmed runtime infostealer + forensic sabotage on any Windows host that runs it)
- **Cluster B - npm `virgil-cli` runtime conversation/shell-output exfil (malicious-package, confirmed runtime credential-grade data exfil in a locally-marketed CLI)**: `virgil-cli` versions `<=0.1.4` (GHSA-6j8f-g5mj-4wcj). The package markets itself as a "free and private" local CLI. In reality, `dist/api.js` exports `reportLearning()` which POSTs the **entire conversation history, every shell command executed, and every file-tool output** - with a hard-coded bearer token and per-install device id - to `https://api.nm-streetwear.space/vx/learn`. No opt-out, no README disclosure, no setting to disable. If a developer ran `virgil-cli` against a repo while piping real credentials, API tokens, SSH keys, kubeconfigs, `.env` files, or chat with any assistant into it, the operator has them. The brand "virgil" and the "learn" endpoint path are chosen to look telemetry-like; this is not telemetry, it is a wholesale extraction of whatever the CLI touched. Classified `malicious-package`, severity `high` (confirmed runtime exfil of credential-grade material from any session that ran it)
- **Cluster C - npm `dotenv-async` dotenv typosquat (typosquat, CWE-506 boilerplate takedown - no payload analysis)**: `dotenv-async` all versions (GHSA-gp83-4g76-4qg5). CWE-506 boilerplate from the GHSA auto-ingest pipeline: "Any computer that has this package installed or running should be considered fully compromised" with no payload hash, no network IOC, and no source left to inspect (listed as "No known source code"). The name typosquats the real `dotenv` and the `dotenv-webpack`/`dotenv-cli` family. Treat as a confirmed takedown and remove, but severity within sweep is `medium` because no analysis published and the package is already registry-pulled
- **Cluster D - 2 npm `@inpeek/odata*` dep-confusion probes (dependency-confusion, boilerplate takedown with no payload analysis - BACKFILL 2026-10-05)**: `@inpeek/odata` and `@inpeek/odata-angular`, both at sentinel versions `99.99.99`, `99.99.100`, `99.99.101`, `99.99.102` (GHSA-cmm5-vwvx-cv5f, GHSA-7p27-jmq6-46ph). Classic dep-confusion fingerprint: public `@inpeek/*` scope spraying four sequential sentinel versions on top of what is almost certainly an internal `@inpeek` registry at a software vendor named InPeek. GHSA ships only the CWE-506 boilerplate - no published payload, no C2, no hash - so severity within sweep is `medium` (dep-confusion probe without disclosed second-stage). Backfill from 2026-10-05, missed in the 2026-10-05 sweep because it only enumerated npm GHSAs with full-source payload disclosures
- **Cluster E - pypi `erc7730-hackathon` PROBABLY_PENTEST probe (dependency-confusion/pentest artefact, confirmed host-recon beacon - BACKFILL 2026-10-05)**: `erc7730-hackathon` versions `>=99.0.0` (GHSA-vcg2-mffq-hjmg, SHA-256 `9020d8cb4fe701c7e0981ae140af20039845d5d0e0a638c68f3ca3e29adeb221`). OpenSSF classifies it under its `GENERIC-standard-pypi-install-pentest` campaign - i.e. a probe that overrides `setup.py install` to exfiltrate IPs and username on install; no destructive payload. `erc7730` is the Ethereum ERC-7730 metadata-standard working group, so the "hackathon" tag plus the sentinel `99.0.0` version strongly suggest a hackathon-targeted dep-confusion test rather than criminal infrastructure. Severity `medium` within sweep (recon-only, PROBABLY_PENTEST labelled by OpenSSF). Backfill from 2026-10-05
- **Operator continuity check**: today`s window is dominated by three distinct, operator-uncoordinated advisories (not a single-operator burst). The `zencleaner` operator and the `virgil-cli` operator are both NEW to the corpus; neither reuses prior infrastructure we have catalogued. The `nm-streetwear.space` domain (Cluster B) is a shell-brand lure, no prior corpus mention; the `discord.com/api/webhooks/*` channel in Cluster A is throwaway. The 25-gem RubyGems Ethereum/crypto wgkit cluster from 2026-10-05 was MISSED in yesterday`s sweep (which only enumerated npm GHSAs) and is now split out as its own named incident with full IOC detail. Yesterday`s broader operator profiles - `hellscripter`/gitflic.ru (2026-10-05 Cluster A), the Wix dep-confusion operator (2026-10-05 Cluster B), the jsonspack.com pino-impersonator (2026-10-05 Cluster C), the 4444.vbs ChaCha20 loader operator (2026-10-05 Cluster D), the Oleh-Modal wallet-phishing operator (2026-10-05 Cluster I), and the `2026-10-voxeval` cryptominer campaign - are all QUIET today. The `amel10`, `jexkcode`/`noverojs`, `spo365-graph`, `Graphalgo`, `donutautosellsrc`/`aseity*`, `kartyk*`, `tailwind-forms-kit`, `chinazhangsan.ccwu.cc`, `bfox-build-utils`, `fabric-loader-core`/`mfahelper`, and `zeal-utils`/`aveliscare` operators are also QUIET today

## What to do

1. **For Cluster A (`zencleaner` pypi)**: on any Windows host that installed `zencleaner` since 2026-10-06, assume the user`s license keys, Windows username, hostname and public IP are in the operator`s Discord channel AND the Windows event logs for the exposure window are **gone** - do not try to recover attacker evidence from them. Rotate anything that was ever stored as a "license key" or captured by that user; replay recent user activity from EDR/XDR telemetry instead of event logs. Block outbound to `discord.com/api/webhooks` from any host that should not legitimately post to Discord. Block the `ipify.org` and `ifconfig.me` HTTP egress from production hosts
2. **For Cluster B (`virgil-cli` npm)**: grep every `package.json`, `package-lock.json`, `pnpm-lock.yaml`, `yarn.lock`, every `~/.npm` and `~/.pnpm` cache, every shell history and every Docker-image layer for `virgil-cli` at `<=0.1.4`. On any hit: assume the operator has every conversation, every executed shell command, every file-tool output since the CLI ran. Rotate all credentials, API tokens, SSH keys and AI-assistant/API keys that could have been typed into or displayed by that CLI`s stdout/stderr. Block outbound to `api.nm-streetwear.space` and the `nm-streetwear.space` apex at every egress point. Treat `virgil-cli` as unsafe at any version; there is no clean release
3. **For Cluster C (`dotenv-async` npm)**: grep lockfiles for `dotenv-async`. On hit uninstall, delete `node_modules`, delete the lockfile, rebuild from a scope-locked registry. Developers who meant the real `dotenv` (or `@dotenvx/dotenvx`, `dotenv-cli`, `dotenv-webpack`) autocompleted the wrong name - fix the autocomplete and teach `dotenv` as the only safe spelling. No specific IOC published, so no egress blocklist entry
4. **For Cluster D (`@inpeek/odata*` npm dep-confusion)**: if your org publishes `@inpeek/*` on an internal registry, scope-lock it (`@inpeek:registry=https://your-internal-npm/`) and hold the public `@inpeek/odata` and `@inpeek/odata-angular` names with placeholder packages at a plausibly-high version to deny the slug permanently. On hit uninstall + rebuild. No specific IOC published by GHSA
5. **For Cluster E (`erc7730-hackathon` pypi)**: grep every `requirements.txt`, `pyproject.toml`, `Pipfile.lock`, `poetry.lock` for `erc7730-hackathon` across the Ethereum / ERC-7730 metadata working group`s infrastructure. On hit uninstall. If this was in fact your team`s own pentest, de-register the OpenSSF probe by replacing the sentinel `99.0.0` with a legitimate placeholder release under your real internal namespace
6. **For the SPLIT OUT [`rubygems-2026-10-05-eth-crypto-wgkit-cluster`](https://dependencywatch.io/incident/rubygems-2026-10-05-eth-crypto-wgkit-cluster)**: see that incident. If your developers run `gem install` on a crypto / Web3 / Ethereum / Bitcoin / Lightning / TRON workstation, the egress blocks for `45.138.12.177`, `45.138.17.70`, `45.138.17.177`, `45.138.122.177`, `45.138.127.77`, `45.138.172.177` (or the whole `45.138.0.0/16`) belong on the proxy today, and `/tmp/.w1/` is a hunt point on any host that could have run those gems
7. **NEW outbound denylist entries for CI/build-host egress proxies today**: `api.nm-streetwear.space` and the `nm-streetwear.space` apex (Cluster B), the `discord.com/api/webhooks` path (Cluster A - unless your org legitimately uses Discord webhooks, in which case allow-list only the specific webhook IDs), `ipify.org`, `ifconfig.me` (Cluster A IP-enrichment). Keep prior egress blocks in place: `gitflic.ru` and `web.archive.org/web/https://gitflic.ru/*` (per [2026-10-05 Cluster A](https://dependencywatch.io/incident/multi-2026-10-05-ghsa-malware-sweep)), `api.wagmiwallet.org` (per 2026-10-05 Cluster I), `backend-cybersecuritydashboard.onrender.com` (per 2026-10-05 Cluster G), `10.0.49.106:443` and all RFC1918 from CI (per 2026-10-05 Cluster F), Monero mining pools (per [2026-10-04 Cluster A `voxeval` cryptominer](https://dependencywatch.io/incident/multi-2026-10-04-ghsa-malware-sweep)), Ethereum mainnet / Sepolia / Arbitrum Sepolia RPC, `chinazhangsan.ccwu.cc`, `api.npoint.io`, `api.telegram.org`, `fabric-npm.gm-service.xyz`, `jsonkeeper.com`, `trktgq0wbre1`, `npm-canary.aveliscare.com`, Polygon RPC, `meta.brs.cx`, `s3://pkusinski-external/`, AWS account `631484165566`, Slack bot-token exfil, `s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook`, and the newly-added `45.138.0.0/16` RubyGems wgkit CIDRs per the split-out ruby incident

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json
- Check a requirements.txt against this incident: https://dependencywatch.io/check/requirements-txt

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GitHub Advisory Database - recent malware advisories](https://github.com/advisories?query=type%3Amalware&sort=published-desc) - GitHub
- [GHSA-4493-p4qp-qw6p - pypi zencleaner (Cluster A - Discord-webhook infostealer + Windows event-log wipe)](https://github.com/advisories/GHSA-4493-p4qp-qw6p) - GitHub
- [GHSA-6j8f-g5mj-4wcj - npm virgil-cli (Cluster B - runtime conversation/shell-output exfil to api.nm-streetwear.space)](https://github.com/advisories/GHSA-6j8f-g5mj-4wcj) - GitHub
- [GHSA-gp83-4g76-4qg5 - npm dotenv-async (Cluster C - dotenv typosquat, CWE-506 boilerplate)](https://github.com/advisories/GHSA-gp83-4g76-4qg5) - GitHub
- [GHSA-cmm5-vwvx-cv5f - npm @inpeek/odata (Cluster D - BACKFILL 2026-10-05 dep-confusion sentinel versions)](https://github.com/advisories/GHSA-cmm5-vwvx-cv5f) - GitHub
- [GHSA-7p27-jmq6-46ph - npm @inpeek/odata-angular (Cluster D - BACKFILL 2026-10-05 dep-confusion sentinel versions)](https://github.com/advisories/GHSA-7p27-jmq6-46ph) - GitHub
- [GHSA-vcg2-mffq-hjmg - pypi erc7730-hackathon (Cluster E - BACKFILL 2026-10-05 OpenSSF PROBABLY_PENTEST probe)](https://github.com/advisories/GHSA-vcg2-mffq-hjmg) - GitHub
- [DependencyWatch: rubygems-2026-10-05-eth-crypto-wgkit-cluster (SPLIT OUT - 25-gem wgkit.tar.gz operator from 2026-10-05)](https://dependencywatch.io/incident/rubygems-2026-10-05-eth-crypto-wgkit-cluster)

---

Canonical page: https://dependencywatch.io/incident/multi-2026-10-06-ghsa-malware-sweep
Markdown version: https://dependencywatch.io/incident/multi-2026-10-06-ghsa-malware-sweep.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).